Use-after-free vulnerability in extensions/renderer/user_script_injector.cc in the Extensions subsystem in Google Chrome before 52.0.2743.82 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to script deletion.

The remote host is affected by the vulnerability described in GLSA-201610-09 (Chromium: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Chromium web       browser. Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, obtain       sensitive information, or bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The specific version of Chrome that the system is running is reportedly affected by the following vulnerabilities:

- Google Chrome contains a flaw in PPAPI that is triggered when handling certain messages not sent by the browser in the plugin broker process. This may allow a context-dependent attacker to bypass the sandbox. (CVE-2016-1706)

- Google Chrome for iOS contains a flaw in web/web_state/ui/crw_web_controller.mm that is triggered when handling invalid URLs. This may allow a context-dependent attacker to conduct URL spoofing attacks. (CVE-2016-1707)

- Google Chrome contains a use-after-free error related to extensions that may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code.
 (CVE-2016-1708)

- Google sfntly contains an array indexing error in the ByteArray::Get() function in data/byte_array.cc that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to cause a heap-based buffer overflow, crashing a process linked against the library or potentially allowing the execution of arbitrary code. (CVE-2016-1709)

- Google Chrome contains a flaw in web/ChromeClientImpl.cpp that is triggered when handling creation of new windows by deferred frames. This may allow a context-dependent attacker to bypass the same-origin policy. (CVE-2016-1710)

- Google Chrome contains a flaw in core/loader/FrameLoader.cpp that is triggered when handling frame navigations during DocumentLoader detach. This may allow a context-dependent attacker to bypass the same-origin policy. (CVE-2016-1711)

- Google Chrome contains a use-after-free error in the previousLinePosition() function in core/editing/VisibleUnits.cpp. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5127)

- Google V8 contains an unspecified flaw which may allow a context-dependent attacker to bypass the same-origin policy. No further details have been provided by the vendor. (CVE-2016-5128)

- Google V8 contains a flaw that is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to corrupt memory and cause a denial of service in a process linked against the library or potentially execute arbitrary code. (CVE-2016-5129)

- Google Chrome contains a flaw in the HistoryController::UpdateForCommit() function in content/renderer/history_controller.cc. The issue is triggered when handling two forward navigations that compete in different frames. This may allow a context-dependent attacker to perform URL spoofing attacks. (CVE-2016-5130)

- Libxml2 contains a use-after-free error in the xmlXPtrRangeToFunction() function in xpointer.c. This may allow a context-dependent attacker to dereference already freed memory and potentially execute arbitrary code. (CVE-2016-5131)

- Google Chrome contains a flaw related to Service Workers that is triggered when handling subframes of an insecure context. This may allow a context-dependent attacker to perform a limited bypass of the same-origin policy. (CVE-2016-5132)

- Google Chrome contains a flaw related to proxy authentication that is triggere when handling origins. This may allow a context-dependent attacker to spoof the proxy server origin. (CVE-2016-5133)

- Google Chrome contains a flaw that is triggered as https:// URLs are not properly sanitized before being sent to PAC scripts. This may allow a context-dependent attacker to leak URLs. (CVE-2016-5134)

- Google Chrome contains a flaw in html/parser/HTMLPreloadScanner.cpp related to the handling of referrer policies. This may allow a context-dependent attacker to bypass the content security policy (CSP). (CVE-2016-5135)

- Google Chrome contains a use-after-free error in extensions/renderer/user_script_injector.cc that is triggered when handling UserScript pointers. This may allow a malicious extension to dereference already freed memory and potentially execute arbitrary code with elevated privileges. (CVE-2016-5136)

- Google Chrome contains a flaw in the CSPSource::portMatches() function in frame/csp/CSPSource.cpp related to HSTS and CSP when handling HTTP vs HTTPS ports in source expressions. This may allow a context-dependent attacker to disclose browsing history information. (CVE-2016-5137)

- Google Chrome contains a flaw in the LayoutBox::removeFloatingOrPositionedChildFromBlockLists() function in core/layout/LayoutBox.cpp that is triggered when handling LayoutView floats. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1705)

- Google Chrome contains a flaw in the Resource::canUseCacheValidator() function in core/fetch/Resource.cpp that is triggered when revalidating Resource with redirects. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains a flaw in the Resource::willFollowRedirect() function in core/fetch/Resource.cpp that is triggered when handling redirect responses while revalidating resources. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains a flaw in net/url_request/sdch_dictionary_fetcher.cc that is triggered when handling dictionary requests failing after receiving data. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains a flaw in the ShapeResultSpacing::computeSpacing() function in platform/fonts/shaping/ShapeResultSpacing.cpp that is triggered as certain input is not properly validated. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1705)

- Google Chrome contains a flaw in the Channel::Message::Deserialize() function in mojo/edk/system/channel.cc that is triggered when handling header sizes in channel messages. This may allow a context-dependent attacker to potentially execute arbitrary code. (CVE-2016-1705)

- Google Chrome contains an unspecified flaw in Font::individualCharacterRanges() function in platform/fonts/Font.cpp, which may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google WebRTC contains an out-of-bounds read flaw in the WebRtcIsacfix_PitchFilter() and WebRtcIsacfix_PitchFilterGains() functions in modules/audio_coding/codecs/isac/fix/source/pitch_filter.c that may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents. (CVE-2016-1705)

- Google Chrome contains a flaw in org/chromium/chrome/browser/toolbar/CustomTabToolbarAnimationDelegate.java that is due to the program failing to properly load security icons on custom HTTP connection tabs. This may allow a context-dependent attacker to spoof valid icons. (CVE-2016-1705)

- Google Skia contains an integer overflow condition in the SkLinearGradient::LinearGradientContext::shade4_dx_clamp() function in effects/gradients/SkLinearGradient.cpp . The issue is triggered as user-supplied input is not properly validated. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- libvpx contains an invalid read flaw in the setup_frame_size_with_refs() function in vp9/decoder/vp9_decodeframe.c that may allow a context-dependent attacker to crash a process linked against the library or potentially disclose memory contents.

- Google Chrome contains an unspecified flaw in extensions that is triggered during the handling of NativeMessaging IDs. This may allow a context-dependent attacker to have an unspecified impact. (CVE-2016-1705)

- Google Chrome contains an out-of-bounds read flaw in the HTMLMenuItemElement::defaultEventHandler() function in core/html/HTMLMenuItemElement.cpp that may allow a context-dependent attacker to potentially disclose memory contents. (CVE-2016-1705)

- Google Chrome contains an unspecified flaw in the GURL::ReplaceComponents() function in url/gurl.cc that is triggered during inner URL creation. This may allow a context-dependent attacker to have an unspecified impact. No further details have been provided. (CVE-2016-1705)

- Google V8 contains an unspecified flaw that may allow a context-dependent attacker to have an unspecified impact. No further details have been provided by the vendor. (CVE-2016-1705)

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2016-1704     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1705     The chrome development team found and fixed various     issues during internal auditing.

  - CVE-2016-1706     Pinkie Pie discovered a way to escape the Pepper Plugin     API sandbox.

  - CVE-2016-1707     xisigr discovered a URL spoofing issue.

  - CVE-2016-1708     Adam Varsan discovered a use-after-free issue.

  - CVE-2016-1709     ChenQin discovered a buffer overflow issue in the sfntly     library.

  - CVE-2016-1710     Mariusz Mlynski discovered a same-origin bypass.

  - CVE-2016-1711     Mariusz Mlynski discovered another same-origin bypass.

  - CVE-2016-5127     cloudfuzzer discovered a use-after-free issue.

  - CVE-2016-5128     A same-origin bypass issue was discovered in the v8     JavaScript library.

  - CVE-2016-5129     Jeonghoon Shin discovered a memory corruption issue in     the v8 JavaScript library.

  - CVE-2016-5130     Widih Matar discovered a URL spoofing issue.

  - CVE-2016-5131     Nick Wellnhofer discovered a use-after-free issue in the     libxml2 library.

  - CVE-2016-5132     Ben Kelly discovered a same-origin bypass.

  - CVE-2016-5133     Patch Eudor discovered an issue in proxy authentication.

  - CVE-2016-5134     Paul Stone discovered an information leak in the Proxy     Auto-Config feature.

  - CVE-2016-5135     ShenYeYinJiu discovered a way to bypass the Content     Security Policy.

  - CVE-2016-5136     Rob Wu discovered a use-after-free issue.

  - CVE-2016-5137     Xiaoyin Liu discovered a way to discover whether an HSTS     website had been visited.

Chromium was updated to 52.0.2743.82 to fix the following security issues (boo#989901) :

  - CVE-2016-1706: Sandbox escape in PPAPI

  - CVE-2016-1707: URL spoofing on iOS

  - CVE-2016-1708: Use-after-free in Extensions

  - CVE-2016-1709: Heap-buffer-overflow in sfntly

  - CVE-2016-1710: Same-origin bypass in Blink

  - CVE-2016-1711: Same-origin bypass in Blink

  - CVE-2016-5127: Use-after-free in Blink

  - CVE-2016-5128: Same-origin bypass in V8

  - CVE-2016-5129: Memory corruption in V8

  - CVE-2016-5130: URL spoofing

  - CVE-2016-5131: Use-after-free in libxml

  - CVE-2016-5132: Limited same-origin bypass in Service     Workers

  - CVE-2016-5133: Origin confusion in proxy authentication

  - CVE-2016-5134: URL leakage via PAC script

  - CVE-2016-5135: Content-Security-Policy bypass

  - CVE-2016-5136: Use after free in extensions

  - CVE-2016-5137: History sniffing with HSTS and CSP

  - CVE-2016-1705: Various fixes from internal audits,     fuzzing and other initiatives

The version of Google Chrome installed on the remote Mac OS X host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified vulnerabilities exist that allow a     remote attacker to cause a denial of service condition     or possibly have other impact via unknown vectors.
    (CVE-2016-1705)

  - A sandbox protection bypass vulnerability exists in     PPAPI due to a failure to validate the origin of IPC     messages to the plugin broker process. An     unauthenticated, remote attacker can exploit this to     bypass the sandbox. (CVE-2016-1706)

  - A use-after-free error exists in Extensions due to a     failure to consider object lifetimes during progress     observation. An unauthenticated, remote attacker can     exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1708)

  - An array indexing error exists in the ByteArray::Get()     function in data/byte_array.cc due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1709)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to prevent window creation by a deferred     frame. A remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-1710)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to disable frame navigation during a detach     operation on a DocumentLoader object. A remote attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1711)

  - A use-after-free error exists in Blink in the     previousLinePosition() function. An unauthenticated,     remote attacker can exploit this, via crafted JavaScript     code involving an @import at-rule in a Cascading Style     Sheets (CSS) token sequence in conjunction with a     rel=import attribute of a LINK element, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5127)

  - A same-origin bypass vulnerability exists in Google V8     due to a failure to prevent API interceptors from     modifying a store target without setting a property. A     remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5128)

  - A flaw exists in V8 due to improper processing of     left-trimmed objects. An unauthenticated, remote     attacker can exploit this, via crafted JavaScript code,     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-5129)

  - A flaw exists that is triggered when handling two     forward navigations that compete in different frames. A     remote attacker can exploit this to conduct a URL     spoofing attack. (CVE-2016-5130)

  - A use-after-free error exists in libxml2 in the     xmlXPtrRangeToFunction() function. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-5131)

  - A same-origin bypass vulnerability exists in the Service     Workers subsystem due to a failure to properly implement     the Secure Contexts specification during decisions about     whether to control a subframe. A remote attacker can     exploit this to bypass the same-origin policy.
    (CVE-2016-5132)

  - A flaw exists in the handling of origin information     during proxy authentication that allows a     man-in-the-middle attacker to spoof a     proxy-authentication login prompt or trigger incorrect     credential storage by modifying the client-server data     stream. (CVE-2016-5133)

  - A validation flaw exists in the Proxy Auto-Config (PAC)     feature due to a failure to ensure that URL information     is restricted to a scheme, host, and port. A remote     attacker can exploit this to disclose credentials by     operating a server with a PAC script. (CVE-2016-5134)

  - A cross-origin bypass vulnerability exists in Blink due     to a failure to consider referrer-policy information     inside an HTML document during a preload request. A     remote attacker can exploit this to bypass the Content     Security Policy (CSP) protection mechanism.
    (CVE-2016-5135)

  - A use-after-free error exists in Extensions that allows     a remote attacker to dereference already freed memory,     resulting in the execution of arbitrary code with     elevated privileges. (CVE-2016-5136)

  - An information disclosure vulnerability exists in Blink     when handling HTTP vs HTTPs ports in source expressions.
    An unauthenticated, remote attacker can exploit this to     determine whether a specific HTTP Strict Transport     Security (HSTS) web site has been visited by reading a     CSP report. (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 52.0.2743.82. It is, therefore, affected by multiple vulnerabilities :

  - Multiple unspecified vulnerabilities exist that allow a     remote attacker to cause a denial of service condition     or possibly have other impact via unknown vectors.
    (CVE-2016-1705)

  - A sandbox protection bypass vulnerability exists in     PPAPI due to a failure to validate the origin of IPC     messages to the plugin broker process. An     unauthenticated, remote attacker can exploit this to     bypass the sandbox. (CVE-2016-1706)

  - A use-after-free error exists in Extensions due to a     failure to consider object lifetimes during progress     observation. An unauthenticated, remote attacker can     exploit this to dereference already freed memory,     resulting in the execution of arbitrary code.
    (CVE-2016-1708)

  - An array indexing error exists in the ByteArray::Get()     function in data/byte_array.cc due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1709)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to prevent window creation by a deferred     frame. A remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-1710)

  - A same-origin bypass vulnerability exists in Blink due     to a failure to disable frame navigation during a detach     operation on a DocumentLoader object. A remote attacker     can exploit this to bypass the same-origin policy.
    (CVE-2016-1711)

  - A use-after-free error exists in Blink in the     previousLinePosition() function. An unauthenticated,     remote attacker can exploit this, via crafted JavaScript     code involving an @import at-rule in a Cascading Style     Sheets (CSS) token sequence in conjunction with a     rel=import attribute of a LINK element, to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2016-5127)

  - A same-origin bypass vulnerability exists in Google V8     due to a failure to prevent API interceptors from     modifying a store target without setting a property. A     remote attacker can exploit this to bypass the     same-origin policy. (CVE-2016-5128)

  - A flaw exists in V8 due to improper processing of     left-trimmed objects. An unauthenticated, remote     attacker can exploit this, via crafted JavaScript code,     to cause a denial of service condition or the execution     of arbitrary code. (CVE-2016-5129)

  - A flaw exists that is triggered when handling two     forward navigations that compete in different frames. A     remote attacker can exploit this to conduct a URL     spoofing attack. (CVE-2016-5130)

  - A use-after-free error exists in libxml2 in the     xmlXPtrRangeToFunction() function. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2016-5131)

  - A same-origin bypass vulnerability exists in the Service     Workers subsystem due to a failure to properly implement     the Secure Contexts specification during decisions about     whether to control a subframe. A remote attacker can     exploit this to bypass the same-origin policy.
    (CVE-2016-5132)

  - A flaw exists in the handling of origin information     during proxy authentication that allows a     man-in-the-middle attacker to spoof a     proxy-authentication login prompt or trigger incorrect     credential storage by modifying the client-server data     stream. (CVE-2016-5133)

  - A validation flaw exists in the Proxy Auto-Config (PAC)     feature due to a failure to ensure that URL information     is restricted to a scheme, host, and port. A remote     attacker can exploit this to disclose credentials by     operating a server with a PAC script. (CVE-2016-5134)

  - A cross-origin bypass vulnerability exists in Blink due     to a failure to consider referrer-policy information     inside an HTML document during a preload request. A     remote attacker can exploit this to bypass the Content     Security Policy (CSP) protection mechanism.
    (CVE-2016-5135)

  - A use-after-free error exists in Extensions that allows     a remote attacker to dereference already freed memory,     resulting in the execution of arbitrary code with     elevated privileges. (CVE-2016-5136)

  - An information disclosure vulnerability exists in Blink     when handling HTTP vs HTTPs ports in source expressions.
    An unauthenticated, remote attacker can exploit this to     determine whether a specific HTTP Strict Transport     Security (HSTS) web site has been visited by reading a     CSP report. (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2016:1485 advisory.

  - chromium-browser: various fixes from internal audits (CVE-2016-1705)

  - chromium-browser: sandbox escape in ppapi (CVE-2016-1706)

  - chromium-browser: use-after-free in extensions (CVE-2016-1708)

  - chromium-browser: heap-buffer-overflow in sfntly (CVE-2016-1709)

  - chromium-browser: same-origin bypass in blink (CVE-2016-1710, CVE-2016-1711)

  - chromium-browser: use-after-free in blink (CVE-2016-5127)

  - chromium-browser: same-origin bypass in v8 (CVE-2016-5128)

  - chromium-browser: memory corruption in v8 (CVE-2016-5129)

  - chromium-browser: url spoofing (CVE-2016-5130)

  - libxml2: Use after free triggered by XPointer paths beginning with range-to (CVE-2016-5131)

  - chromium-browser: limited same-origin bypass in service workers (CVE-2016-5132)

  - chromium-browser: origin confusion in proxy authentication (CVE-2016-5133)

  - chromium-browser: url leakage via pac script (CVE-2016-5134)

  - chromium-browser: content-security-policy bypass (CVE-2016-5135)

  - chromium-browser: use after free in extensions (CVE-2016-5136)

  - chromium-browser: history sniffing with hsts and csp (CVE-2016-5137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

48 security fixes in this release, including :

- [610600] High CVE-2016-1706: Sandbox escape in PPAPI. Credit to Pinkie Pie xisigr of Tencent's Xuanwu Lab

- [613949] High CVE-2016-1708: Use-after-free in Extensions. Credit to Adam Varsan

- [614934] High CVE-2016-1709: Heap-buffer-overflow in sfntly. Credit to ChenQin of Topsec Security Team

- [616907] High CVE-2016-1710: Same-origin bypass in Blink. Credit to Mariusz Mlynski

- [617495] High CVE-2016-1711: Same-origin bypass in Blink. Credit to Mariusz Mlynski

- [618237] High CVE-2016-5127: Use-after-free in Blink. Credit to cloudfuzzer

- [619166] High CVE-2016-5128: Same-origin bypass in V8. Credit to Anonymous

- [620553] High CVE-2016-5129: Memory corruption in V8. Credit to Jeonghoon Shin

- [623319] High CVE-2016-5130: URL spoofing. Credit to Wadih Matar

- [623378] High CVE-2016-5131: Use-after-free in libxml. Credit to Nick Wellnhofer

- [607543] Medium CVE-2016-5132: Limited same-origin bypass in Service Workers. Credit to Ben Kelly

- [613626] Medium CVE-2016-5133: Origin confusion in proxy authentication. Credit to Patch Eudor

- [593759] Medium CVE-2016-5134: URL leakage via PAC script. Credit to Paul Stone

- [605451] Medium CVE-2016-5135: Content-Security-Policy bypass.
Credit to kingxwy

- [625393] Medium CVE-2016-5136: Use after free in extensions. Credit to Rob Wu

- [625945] Medium CVE-2016-5137: History sniffing with HSTS and CSP.
Credit to Xiaoyin Liu

- [629852] CVE-2016-1705: Various fixes from internal audits, fuzzing and other initiatives.

ID	Name	Product	Family	Severity
94420	GLSA-201610-09 : Chromium: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
802027	Chrome < 52.0.2743.82 Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
92666	Debian DSA-3637-1 : chromium-browser - security update	Nessus	Debian Local Security Checks	critical
92655	openSUSE Security Update : Chromium (openSUSE-2016-919)	Nessus	SuSE Local Security Checks	critical
92629	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities (Mac OS X)	Nessus	MacOS X Local Security Checks	critical
92628	Google Chrome < 52.0.2743.82 Multiple Vulnerabilities	Nessus	Windows	critical
92552	RHEL 6 : chromium-browser (RHSA-2016:1485)	Nessus	Red Hat Local Security Checks	critical
92551	openSUSE Security Update : Chromium (openSUSE-2016-901)	Nessus	SuSE Local Security Checks	critical
92550	openSUSE Security Update : Chromium (openSUSE-2016-900)	Nessus	SuSE Local Security Checks	critical
92537	FreeBSD : chromium -- multiple vulnerabilities (6fae9fe1-5048-11e6-8aa7-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-5136

high

Tenable Plugins

critical

high

critical

critical

critical

critical

critical

critical

critical

critical